Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-54945 | 10.0 critical | 1.0% | sun.net, ehrd_ctms | An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path. | 18 Oct |
| CVE-2025-54944 | 6.9 medium | 1.0% | sun.net, ehrd_ctms | An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to write malicious code in a specific file, which may lead to arbitrary code execution. | 18 Oct |
| CVE-2025-54942 | 9.3 critical | 0.00% | sun.net, ehrd_ctms | A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deployment functionality without prior authentication. | 18 Oct |
| CVE-2025-54943 | 9.3 critical | 0.00% | sun.net, ehrd_ctms | A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks. | 18 Oct |
| CVE-2025-54946 | 9.3 critical | 0.00% | sun.net, ehrd_ctms | A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands. | 18 Oct |
| CVE-2026-7489 | 8.7 high | 0.00% | sun.net, ehrd_ctms | CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. | Mon 26 Oct |
| CVE-2026-7490 | 8.6 high | 0.00% | sun.net, ehrd_cpas, ehrd_ctms | CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. | Mon 26 Oct |
7 of 7
Download these 7 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.